I do not see why we cannot blame the law. The argument seems pretty trivial to make. If a company does not overreact they have a low chance of being hit with a very large penalty (loss of safe haven and lawsuit), whereas if they overreact they have a high chance of facing a small penalty (loss of some customers and some bad publicity). The logical decision for any business would be to take a high chance of a small penalty over a low chance of a high penalty, to maintain stability. So the law here is systematically encouraging businesses to overreact, which seems like a bad law to me.